Amazon Disrupts APT29 Watering Hole Campaign Abusing Microsoft Device Code Authentication

Amazon said it flagged and disrupted an opportunistic watering hole campaign attributed to the Russia-linked APT29, as part of its intelligence efforts. The operation redirected about 10% of visitors on compromised sites to actor‑controlled domains, including findcloudflare[.]com, which mimicked Cloudflare verification pages to appear legitimate. Victims were enticed to input a legitimate device code generated by the threat actors into a sign‑in page, effectively granting access to Microsoft accounts and data.

The campaign used JavaScript injections and evasion techniques such as Base64 encoding and cookies to prevent repeated redirects, with the actors switching infrastructure when blocked and moving to new domains like cloudflare.redirectpartners[.]com. According to Amazon's Chief Information Security Officer CJ Moses, the activity shows APT29’s evolving approach to harvest credentials and broaden their intelligence collection while refining their tradecraft. APT29 is also known by multiple aliases including BlueBravo, Cloaked Ursa, CozyBear, Earth Koshchei, ICECAP, Midnight Blizzard, and The Dukes.